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Section 1: 
Executive Summary 


he college or university campus sometimes 

feels like an incredibly risky space. Headlines 

shout about sexual abuse scandals, campus 
demonstrations that veer toward riots, and active 
shooters who threaten lives. 


Hazards can be physical—fires or floods that the 
modern campus, for all its technical sophistication, 
is still unable to withstand. Threats can also be 
virtual—attacks by hackers from halfway across the 
globe, or whispers on social media that turn into 
rants. Both types of risks can leave the institution 
damaged, vulnerable, and struggling to return to 
normal operations. 


If there is a silver lining to these threats, it’s that 
their prominence has made campus leaders more 
aware that they walk every day along the edge of 
a cliff—and that maybe they should put up some 
handrails before someone falls off. In other words, 
colleges and universities are taking seriously the 
challenge of risk and implementing processes to 
help prepare and protect their institutions. 


Assessing and mitigating risk 
across the campus 


The hard-earned experience of other campuses 
suggests a framework for effective risk manage- 
ment: enterprise risk management (ERM). ERM is 
an institution-wide, proactive approach toward risk. 
With the support of the board and the oversight 

of the CEO, ERM helps colleges and universities 
assess all types of risks to the institution, including 
the following: 


H Strategic risks: Risks to an organization’s ability 
to achieve its goals. 

@ Financial risks: Risks that could result in loss of 
assets. 

MH Operational risks: Risks that affect the insti- 
tution’s ability to do everyday work, including 
instruction. 


HM Compliance risks: Risks that involve externally 
imposed laws and regulations as well as internal 
policies and procedures. 

H Reputational risks: Risks to the organization’s 
brand or reputation. 


ERM takes a strategic and comprehensive ap- 
proach. Risk is understood as a part of doing 
business—no operation is without risk—and 
something that must be managed for the college or 
university to achieve its goals. However, not all risk 
is equal—some threats are more dangerous than 
others. ERM incorporates risk assessment in which 
hazards are formally evaluated. Different colleges, 
universities, and schools employ different assess- 
ment methods, but at the most basic level, risks are 
ranked by their likelihood and potential impact. 
The most likely and most significant risks are those 
that receive greatest attention. 


ERM also emphasizes a truth sometimes forgotten: 
that with risks come opportunities. Changing polit- 
ical or social situations can harm the institution but 
also help it; new initiatives carry the risk of failure 
but also the potential for success. Colleges and uni- 
versities should beware of becoming so rigid—or 

so fearful—that they fail to seize the opportunities 
that present themselves. 


The ultimate goal of ERM on campus is to increase 
the flexibility and adaptability of the institution; 
the college or university should be able respond to 
disasters while recognizing potential victories. 


Risk and the facilities management 
organization 


As the professional association for higher education 
facilities staff that ensures excellence in today’s 
educational environment, APPA recognizes the 
role that risk plays in the work of its member in- 
stitutions. The 2018 Thought Leaders symposium 
focused on risk both across the campus as a whole 
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and as it impacts the facilities organization in par- 
ticular. APPA invited both senior facilities officers 
and representatives of multiple campus constitu- 
encies to the symposium, including presidents and 
chancellors, chief finance officers, leaders in both 
academic and student services, and senior risk man- 
agers. Together, the symposium participants learned 
about ERM, assessed the risks confronting their 
industry and institutions, and reviewed strategies 
for mitigating threats. 


Symposium participants identified six major risk 
areas that higher education institutions must con- 
sider for their campuses: 


Revenue and investments 

Brand and reputation 

Health and safety 

Innovation 

Facilities 

Changing political/cultural environment. 


They also considered the role of facilities in man- 
aging risk, concluding that the facilities department 
has much to offer the institution. The facilities 
operation has one of the largest workforces on cam- 
pus, and facilities staff are out in the community 
every day. They often see what no other faculty or 
staff would be in the position to notice, and they 
mitigate risks by alerting the appropriate offices 

to signs of depression or other mental illness in 
students, to damage or vandalism to institution 
property, and to potential facilities failures. At 

the same time, this workforce is uniquely posi- 
tioned to help the campus in the case of a crisis or 
emergency. Facilities staff have a customer-service 
attitude combined with in-depth familiarity with 
every corner of the campus. 


Symposium participants also looked at the risks 
and opportunities facing the campus built envi- 
ronment. They identified the following risks to 
facilities and facilities operations: 


Financial shortfalls and facilities failures 
Natural disasters 

Lack of a qualified workforce 
Technology failures 

Utility infrastructure failures 

Compliance issues 

Institutional curb appeal/first impression. 
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Then they evaluated the following opportunities 
for improving the contribution of facilities to the 
institution: 


MH Energy conservation 
MH Fuel and utility strategies 

HM Green technology 

H Facilities supporting student success 

HM Resources to respond to emergencies. 

This report concludes with a list of questions de- 
veloped by participants to encourage discussion and 
debate on your campus. We encourage institutions 
to evaluate their existing risk management strategy 
and consider where it succeeds and fails. No matter 
where your campus finds itself, improvements can 
be made. If your institution has made little com- 
mitment to risk management, what concrete first 
steps can you take to move the campus forward? If 
your institution has embraced enterprise risk man- 
agement, where are efforts still falling short? 


A hard look at risk on APPA 
member campuses 


Shortly before the Thought Leaders symposium, 
APPA decided to better understand the state of 
risk on its member campuses. APPA released a 
survey asking members about risk preparedness, ef- 
fectiveness, and roles and accountability. The results 
of this survey are found throughout this report. 
You're encouraged to benchmark the results of our 
membership with data from your own institution. 


To gather even more data, symposium participants 
were asked how they would rank their institution’s 
risk readiness on a scale of 1 to 10, with 10 the 
most prepared and 1 the least prepared. The aver- 
age score from participants was 6.89. Some simple 
statistical analysis finds that the median (the divid- 
ing point between the greater and lesser halves of 
the dataset) was 7 and the mode (the most frequent 
value in the dataset) was 8. 


It’s interesting to combine this number with the 
results of the survey question, “How effective is 
your institution at managing risk?” More than 
60 percent of respondents found their institution 
was doing either “very good” (21.47%) or “good” 
(41.72%). 
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This suggests that overall, facilities leaders believe 
their institutions are paying attention to risk and 
taking steps to improve their readiness—they are 
confident that a solid foundation of risk manage- 
ment has been laid. 


Data Point: 
Risk communications 
Risk = Hazard + Outrage 


One of the greatest challenges in managing 
risk is that people tend to underestimate cer- 
tain threats while overestimating others. Risk 
communication expert Peter Sandman has 
spent most of his career helping his clients un- 
derstand this challenge. 


“If you distinguish two characteristics of a 
risk—how dangerous is it versus how upset- 
ting is it—let’s give ‘em labels. Let’s call how 
dangerous it is ‘hazard.’ Let’s call how upset- 
ting it is ‘outrage.’ The correlation between 
hazard and outrage is extremely low,” said 
Sandman in a 2013 interview on public radio’s 
On the Media. “What this means is if you know 
a risk is dangerous, that tells you almost noth- 
ing about whether it’s upsetting. If you know a 
risk is upsetting, that tells you almost nothing 
about whether it’s dangerous.” 


In practical terms, that means people are more 
likely to be afraid of terrorists hijacking their 
airplane than having their car crash on their 
way to the airport—or slipping in the shower 
before they leave the house. 


Sometimes the role of risk managers is to in- 
crease attention to hazards that people tend to 


But like waves in the ocean, risks never stop 
pounding on colleges and universities. Inevitably, 
risks that you never anticipated will strike. And 
you never want to turn on the news one morning 
and find that your campus is the headline—for the 
wrong reason. 


ignore. Sandman calls this “precaution advo- 
cacy.” “The paradigm in precaution advocacy 
is ‘watch out, this could kill you. Do something. 
Wear a seatbelt, wear a hard hat,’” he said. 


Other times, the job is to manage outrage 
about unlikely threats. Sandman emphasizes 
that outrage is mitigated by trust (“If | trust 
you, I’m going to find the risk that you are ex- 
posing me to much more acceptable than if | 
don’t trust you.”) and control (“If it’s under my 
control, I’m going to be less upset than if it’s 
under your control.”) 


Outrage has a tendency to shut down rational 
thought, Sandman explained, and when some- 
one is outraged they need to feel like they are 
heard and their fears acknowledged before 
they can calm down enough to start to think 
logically. “When people don’t understand the 
data, it’s not because they can’t. It’s because 
they choose not to. And that’s a function of 
outrage. So if you can reduce the outrage, then 
they’re more interested in the data. Then you 
can begin to educate them,” said Sandman. 


Source: Excerpts from “Terrorists vs. Bathtubs,” On the Media, WNYC Studios, June 21, 2013. 
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Identifying Enterprise Risks and Opportunities 


Taking an enterprise-wide 
approach to risk management 


Colleges and universities have always faced risks, 
but it wasn't until the 1980s that institutions began 
thinking systematically about managing threats to 
their organization. Today, college and university 
leaders can draw on several decades of research and 
best practices that have clarified our understanding 
of risk. 


A widely used definition of risk is one proposed by 
the National Association of College and University 
Business Officers (NACUBO): 


Risk is any issue that impacts an 
organization’s ability to meet its objectives. 


This is a necessarily broad definition. Institutions 
face a bewildering variety of risks—competitive, 
financial, operational, environmental, technologi- 
cal, regulatory, reputational, political. Risk can be 
as small as a slippery tile floor and as large as the 
funding process for the entire institution. The size 
and complexity of college and university campuses 
and the number of people who walk their grounds 
every day are factors that combine to create count- 
less risks. 


Attempting to identify all of these risks would be 
an exercise in exhaustion—but too often colleges 
and universities become bogged down with catalog- 
ing threats. It’s certainly important to classify risks, 
and this report will explore ways to do so. Institu- 
tions can spend enormous energy and capital trying 
to enumerate every single risk they could possibly 
face. Yet a lengthy and detailed list of threats does 
nothing on its own to prepare an institution to 


deal with those threats. 


The first step of risk management should not 

be creating lists but rather developing an insti- 
tution-wide framework for addressing risk and 
change. This is the message of risk experts such as 
Janice Abraham, President and CEO of United 
Educators Insurance, who emphasizes the impor- 
tance of enterprise risk management (ERM). 
ERM is defined as a business process that takes a 
strategic and campus-wide approach to risk. 


“When colleges and universities first started think- 
ing about risk, the process was transactional and 
reactionary,” said Abraham, speaking at the APPA 
Thought Leaders symposium. “It was focused on 
transferring risk away from the college or univer- 
sity.” Over time, risk management became more 
integrated into college or university processes. 
“People began to think of risk as an expense that 
should be minimized. It was driven by issues of 
compliance.” 


Savvy institutions go beyond integrated risk and 
seek to transform risk management into a stra- 
tegic, enterprise-wide business process. “ERM 
emphasizes optimizing risks to achieve enterprise 
goals,” said Abraham. “And it includes the under- 
standing that alongside risks come opportunities. 
Colleges and universities need to be open to new 
possibilities at the same time they prepare to face 
threats.” 


The primary goal of ERM, according to Abraham, 
is culture change. When an institution is practicing 
ERM, it has incorporated a well-organized ap- 
proach to risk management, one that addresses the 
entire organization. The college or university has 
the skills and capacity to be flexible and adapt to an 
ever-changing environment. When an unexpected 
crisis hits, the institution takes it in stride; when an 
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Data Point: 
Enterprise risk management 


How effective is your institution at mitigating risk? 


Very good - 
a top priority 


Good 


Could be better 


We don't 


0% 10% 20% 30% 40% 50% 60% 


Most Senior 
Facilities Officers 
responding to the 
APPA Thought 
Leaders Risk 
Survey believed 
their institutions 
were doing an 
effective job 
managing risk. Only 
3 percent—five 
respondents— 
believed they 
didn’t do well at 
mitigating risk. 


70% 80% 90% 100% 


Source: APPA Thought Leaders Risk Survey, January 2018. 


unexpected opportunity arises, the institution takes 
advantage of the situation. The goals and mission 
of the college or university are unshaken by what- 
ever the world throws its way, and the institution 
can do what it wants to do, not what it Aas to do. 


“This is the goal,” said Abraham. “Maybe you'll 
never quite get there, but it’s what you can aim for.” 


Creating the ERM framework 


Effective enterprise-wide risk management requires 
institutions to create a framework—a structure that 
supports the basic components of ERM. This is a 
central step in ensuring that risk management is 
adopted across the entire college or university, and 
it is the only real way to achieve culture change. 


Many models of ERM frameworks have been 
employed, and each institution will need to shape 
a framework that works for its campus. Some key 
elements of effective frameworks include: 


1. Ensure support of senior management. Risk 
must be championed from the highest levels of 
the institution. If the board and senior leadership 
aren't invested in ERM, efforts will eventually 
stumble. 


2. Develop and communicate a risk management 


policy. For example, the University of Regina’s 
policy on ERM, according to URMIA’s report, 
ERM in Higher Education, states that its objec- 
tive is to “incorporate a consistent approach to 
risk management into the culture and strategic 
planning processes of the University, supporting 
the setting of priorities and making of decisions 
at the institutional level.” 


3. Establish accountability and authority. Risk 


is ultimately everyone’s responsibility, but that 
creates a situation where it can be no one’s re- 
sponsibility. Clear authority needs to rest in key 
figures who will be accountable for their actions. 
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Data Point: 
Enterprise risk management 
Keeping risk assessments up to date 


Risk assessments 

at most campuses 

are fairly up to date, 
according to the APPA 
Thought Leaders 


Never 


Risk Survey. About Bemiiaer 
z 1-4 years 
58 percent of Senior 
Facilities Officers 
reported that their Bervecn 
5 5-9 years 
most recent risk 
assessment was 
between one and Over 3 
decade ago 
four years old. Some 
were older, and three 
respondents (1.84%) Don't know 


said their assessments 
were more than a 0% 10% 
decade old. More than 

a quarter didn’t know 
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30% 40% 50% 60% 70% 80% 90% 100% 


how old their assessments were, but most alarmingly, 14 respondents (8.59%) said their institution 


had never conducted a formal risk assessment. 


Source: APPA Thought Leaders Risk Survey, January 2018. 


Implementing an ERM process 


One of the most important words in the definition 
of ERM is “process.” ERM isn’t something that 

an institution does once. It is an ongoing effort in 
which the college or university is always engaged. 


Abraham presented ERM as a cycle. Different in- 
stitutions have developed their own process, but all 
share, at their core, the following steps: 


1. Identifying threats and opportunities across the 
enterprise. 


2. Categorizing and ranking risks and opportunities 
related to the institution’s plans and mission. 


3. Mitigating risks and responding to emergencies. 


4, Monitoring risks and opportunities and respond- 
ing to changing circumstances. 


Step 4 leads right back to step 1. Emerging risks 
and opportunities must be assessed, and mitiga- 
tion plans must be developed and tested. Over 
time, as situations change, some risks will fade in 
significance and new threats will take their place. 
College and university leaders must constantly 
cycle through the process, keeping up with change 
as it happens. 


We'll look at each step in this process, focusing first 
on risks and then on opportunities. 
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Data Point: 
Enterprise risk management 
Institutions with a formal strategic plan to mitigate risk 


The APPA Thought Leaders 
Risk Survey found that 

about half (50.62%) of 162 
respondents had a formal risk 
management strategy, leaving 
about half (49.38%) without 
such a strategy. 


0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 


Source: APPA Thought Leaders Risk Survey, January 2018. 


Managing risk in higher education viduals direct and sometimes anonymous ways of 
reporting problems or concerns. 


Step 1: Identifying threats. Understanding the 

threats facing the campus requires both an ea- Bl 
gle’s-eye view of the big picture and attention to the 

most mundane—but possibly explosive—details. 


Outside experts and resources. Emerging 
threats are often best understood by tapping the 
wisdom of experts outside of the institution. 
Insurance companies can be helpful, as well as 
outside firms or consultants. Campuses maintain 
relationships with local law enforcement, and 
some reach out to the Federal Bureau of Inves- 
tigation. Institutions can also draw on published 
resources such as risk registers that list common 
campus threats. 


Participants at the 2018 Thought Leaders 
symposium were asked what mechanisms their in- 
stitutions rely on to define and identify risk. Their 
responses fell into several categories: 


@ Individuals or teams within the college or 
university responsible for some facet of risk 
management. The campus leaders tasked with a 
risk management play a major role in bringing 
threats to the attention of the campus. About 
half of the colleges and universities represented 
at the Thought Leaders symposium have a chief 
risk officer or someone with a similar title in 
their organization. But many others within the a 
institution also play a role, including the execu- 
tive leadership team and emergency management 
committees. Experts in specific fields contribute 
assessments of specialized risks, such as eco- 
nomic forecasting or political affairs. 


News and trends. Smart campuses work to stay 
on top of local, national, and international news 
and apply that news to their institution while 
paying attention to social, demographic, and 
economic trends. 


Real-life incidents. While you might hope to 
anticipate all possible threats, inevitably situ- 
ations will arise that you never expected. Any 
time a scandal or crisis hits another campus, the 
smart strategy is to think through how your own 
campus would be exposed in a similar circum- 


: ies stance. 
H The campus community. Many institutions 


seek input from faculty, staff, students, and par- 
ents to better understand threats and how they 
are perceived. Information can flow through 
social media or via formal processes such as town 
hall meetings. Hotlines and fraud lines give indi- 


Risk management experts warn against spend- 
ing too much time listing risks. In the report 4 
Practical Approach to Institutional Risk Manage- 
ment: Getting Risk Right in an Era of Constrained 
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Administrative Resources, the University Business 
Executive Roundtable states, 


Many universities are reluctant to undertake en- 
terprise risk management (ERM) because of its 
administrative intensity, which has only become 
more pronounced after the Great Recession. 
When looking at their peers, many university 
administrators are confronted with a wasteland 
of horror stories of universities spending 18 to 
24 months on risk identification and assessment, 
only to come up with a risk register of 200 to 
500 risks. Of course, this concerns the average 
senior administrator who wonders, “Can our 
university actually begin tackling that many 
risks?” 


A register with 200-plus risks is so vast that it is 
useless to the institution—and the time devoted 

to generating such a list could have been better 
spent. Risk experts suggest jump-starting the risk 
identification process by relying on published risk 
registers from higher education organizations and 
peer institutions. For example, the University Risk 
Management and Insurance Association (URMIA) 
offers a risk inventory that its members can use in 
identifying and ranking threats. 


Data Point: 
Risk identification 
Inverting the 80/20 rule 


“Institutions tend to spend 80 percent of their 
risk management time identifying risks and 20 
percent doing something about those risks, 
such as assessing the impact of risks, assign- 
ing owners to the risks, developing plans to 
reduce risk, and tracking risk. But best practice 
calls for reversing the 80-20 allocation of ef- 
fort... . Using [resources] gleaned from other 
institutions, institutions can jump-start the risk 
identification effort and limit it to 20 percent of 
the effort. Spending the remaining 80 percent 
on assessing the likelihood, impact, and risk 
mitigation strategies (rather than reinventing 
the work done by others) is a far more effi- 
cient use of everyone’s time.” 


Source: Janice M. Abraham, Risk Management: 
An Accountability Guide for University and 
College Boards, Association of Governing Boards 
of Universities and Colleges, 2013. 
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Step 2: Categorizing and ranking risks. The other 
mistake institutions make with their 200-plus list 
of risks is to treat them all equally. Failing to make 
annual copyright infringement disclosure in a 
timely way is a compliance violation and, therefore, 
a risk—but it ranks nowhere near a bomb threat at 
the biggest football game of the year. 


Risks should be grouped into categories that make 
clear both who should be accountable for a partic- 
ular risk and its potential impact to the institution. 
NACUBO proposes five broad categories of risks: 


1. Strategic risks. These risks affect an organi- 
zation’s ability to achieve its goals. They will 
depend on the institution’s mission and goals 
and should include any threat to achieving those 
goals. 


2. Financial risks. These risks are those that could 
result in loss of assets. They will be heavily de- 
pendent on the institution’s funding strategy. 
Pushback against high tuition will dramatically 
impact some institutions, while others will be 
put at greater risk by declining international en- 
rollment. 


3. Operational risks. These risks affect ongoing 
management processes and can include the failed 
rollout of a new payroll system or a major utility 
break that cuts water to half of the campus. 


4. Compliance risks. These risks involve com- 
pliance with externally imposed laws and 
regulations as well as internal policies and proce- 
dures concerning safety, conflict of interest, etc. 
Compliance risks fall on many different divisions 
in the institution—from accounting to facilities 
to research. 


5. Reputational risks. These risks affect an or- 
ganization’s brand or reputation. They can 
encompass any of the above risks—mismanage- 
ment of a natural disaster such as a hurricane 
can be as devastating to a college or university 
as a scandal over failure to comply with Title IX 
requirements. Reputational risks are the hardest 
to quantify—how do you place a value on an in- 
stitution’s good name? 
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Risks should also be assessed so that the institu- 
tion can focus its attention on the most serious 
threats—those with the greatest potential impact 
and the greatest likelihood of happening soon. 
Ifa whiteout blizzard hits your campus in South 
Florida, it would be a catastrophe and you would 
be unprepared—but it’s not very likely, so you 
shouldn't spend much time worrying about it. 
However, a hurricane will almost certainly land 
nearby, and you need a plan for managing the situ- 
ation. 


Institutions use a variety of methods to assess 
threats. One of the most straightforward is the 
“heat map,” a chart used to rank threats by their 
impact and probability. For example: 


High impact/Low 
probability 


High impact/High 
probability 


e Intermediate 
priority for the 
institution 


e Greatest priority 
for the institution 


Low impact/Low 
probability 


Low impact/High 
probability 


e Intermediate 
priority for the 
institution 


e Lowest priority 
for the institution 


a Probability + 


This is an immediately understandable approach 

to risk assessment that allows campuses to quickly 
see which threats deserve the greatest attention. 
Some institutions, such as the University of North 
Carolina at Chapel Hill, add a third factor to the 
heat map, time of likely occurrence. This creates a 
three-dimensional matrix (imagine a Rubik’s Cube) 
in which the highest impact, highest probability, 
and most immediate risks rise to the top. 


Other organizations have proposed different risk 
assessment strategies. NACUBO, for example, sug- 
gests a chart that tracks risks by whether the risk 
is increasing, declining, or remaining the same, 
and by the status of institutional actions set up to 
manage that risk. A newly identified risk for which 
the risk management processes are clearly deficient 
will therefore take priority over a risk for which the 
processes in place are appropriate to the need. 


Another strategy was developed by Brown Uni- 
versity to better understand the potential impact 
of risk. Unlike at a private sector company, where 
risks can be assessed using the bottom line, colleges 
and universities have many risks that are extremely 
difficult to quantify or compare. How can you put 
a dollar figure on students and faculty, or the ped- 
agogical mission of the institution? What is the 
value of deeply beloved historic campus structures 
or the art in a campus museum? Brown addresses 
this challenge by assessing each risk according 

to its potential human impact, asset impact, and 
mission impact. Each of these impacts is defined 
and given a score on a scale from 0 to 3. This pro- 
vides a common language for all stakeholders and 
allows the institution to measure impacts that don’t 
have an easy dollar figure attached. 


The specific strategy each institution uses to assess 
risk will depend on its unique culture and needs. 

A critical principle to keep in mind, however, is to 
keep the process simple. Time devoted to fine-tun- 
ing the risk assessment process is time taken away 
from actually preparing for threats. What matters 
is that the institution understand which threats 
demand the greatest attention. You're looking for 
a priority list, not a dissertation. 
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Data Point: 
Risk assessment 
Clarifying “impact” 
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Brown University uses risk assessment definitions to evaluate impacts that cannot be easily trans- 
lated into dollar figures. The goal is to identify the risks with the greatest impact, even when that 


impact is hard to measure. 


Human Impact 


Possibility of injury, illness, or 
death to Brown community 
members, visitors, or guests 


0 = Not Applicable 


1 = Injuries are treatable with 
first aid 


Asset Impact 


Physical and/or financial losses 
and damages to campus 
facilities, infrastructure, 
reputation, and/or balance 
sheet 


0 = Not Applicable 


1 = Isolated, minimal damage 
or loss, or none at all 


Mission Impact 


The disruption of and/or 
adverse impact of University 
operations, including the 
essential mission of research 
and teaching 


0 = Not Applicable 


1 = No disruption or adverse 
impact to University 


2018 


2 = Injuries/illnesses treatable 2 = Sporadic damage or loss eneee ee 
with medical care, injuries to building and facilities and/ | 2 = Faculty, students, staff 
TLS do not result in permanent or other assets, including temporarily unable to carry 
10 disability or disfigurement reputational damage out University operations 


3 = Injuries lead to permanent 
disability, disfigurement, 
and/or death 


3 = Widespread, critical 
financial loss and/or damage 
to buildings, infrastructure, 
and/or other assets, 
including reputational 
damage 


3 = Significant damage to 
campus and/or loss of 
other essential facilities or 
people requiring temporary 
or permanent suspension 
of normal daily University 
Operations 


Source: University Business Executive Roundtable, A Practical Approach to Institutional Risk Management: 
Getting Risk Right in an Era of Constrained Administrative Resources, The Advisory Board Company, 2012. 


Step 3: Mitigating risks and responding to 
emergencies. One of the first steps in develop- 
ing a risk mitigation strategy is understanding 
the institution’s risk tolerance—how much risk is 
the institution willing to accept? According to 
Abraham, “A board can agree, for example, that 
an institution’s finances can absorb a 10 percent 
decline in enrollment or a rise in interest rates of its | 2. 
variable rate bonds by 300 basis points.” Mitigation 

plans should be prepared for risks that go beyond 

the stated limits. (This strategy does not apply to hall, or a crisis communication plan to deal with 


health and safety risks, where there is no acceptable the press in the event of a public relations scan- 
level of risk.) dal. 


1. Reduction. Reduce the likely frequency or se- 
verity of loss. This might mean improving the 
campus drainage system to reduce the likelihood 
of flooding or installing additional backup sys- 
tems for core university IT systems to prevent 
outages. 


Control. Minimize damage after a loss has oc- 
curred. This could include planning for backup 
housing in case high winds damage a residence 


Several options are available to institutions when 3. 
addressing specific risks. Gallagher Higher Educa- 
tion Practice breaks them into five choices: 


Transfer. Assign responsibility for an activity 
to another party. Insurance is a form of risk 
transfer, and so are some types of design/build 
contracts. 
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4. Acceptance. Assume responsibility for a risk. 
This is most often the case for low-impact and/ 
or low-probability risks and is the right choice 
when mitigating a risk’s costs, even more so than 
dealing with the consequences of the risk itself. 


5. Avoidance. Eliminate or never launch an activ- 
ity because the risk appears too great. This is a 
difficult choice for higher education institutions 
but nevertheless must be on the table. 


Risk reduction and control plans always need an 
owner. Unless someone is responsible and ac- 
countable for a particular risk, the risk won't be 
adequately addressed. Other elements of success- 
ful risk management plans include the following 
elements, according to the Federal Emergency 
Management Agency (FEMA) report, “Building a 
Disaster-Resistant University”: 


HM Goals—General statements of what you want to 
achieve. For example: 
* Minimize interruption to instruction. 
* Protect research activities on campus. 


Data Point: 
Enterprise risk management 
Who “owns” risk 


The APPA Thought 

Leaders Risk Survey Tits Chick 
asked Senior Facilities Financial Officer 
Officers who was (CFO) 
responsible for risk at 
their institution. Out 

of the 144 responses 
received, the Chief 
Financial Officer (CFO) 
was most likely to be 
identified as the owner 
of institutional risk (at 
38.19%). However, 
29.86 percent of 
respondents said risk 
wasn’t owed by any 
one department or 


A risk management 
department 


Chief Risk Officer 
(or similar title) 


It's not really owned 
by one department 
or individual 


0% 10% 


MH Objective—Strategies or steps to attain identi- 
fied goals. For example: 
* Inform the campus community about poten- 
tial hazards and appropriate actions. 
* Protect lab equipment valued at $5,000 or 
more. 


BH Mitigation actions—Specific actions to achieve 
your goals. For example: 
* Retrofit lab equipment. 
* Develop annual training sessions for lab 
directors on hazard mitigation. 


While FEMA focuses on natural disasters, the 
same elements are appropriate for many types of 
mitigation plans. We will discuss more detailed 
mitigation strategies for specific types of threats 
later in this document. 


20% 30% 40% 50% 60% 70% 80% 90% 100% 


individual. This sounds worrisome—is no one accountable?— but comments from respondents 
paint a more detailed picture. Several institutions placed risk under the CFO, but not directly on 
the CFO. Several other respondents said the facilities organization was responsible for risk. Other 
institutions relied on risk management teams or committees, and others described a structure 
where risk is distributed across different departments. 


Source: APPA Thought Leaders Risk Survey, January 2018. 
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Step 4: Monitoring risks and responding to 
changing circumstances. ERM is never done. 
Colleges and universities must constantly moni- 
tor identified threats and scan for emerging risks. 
Periodically the entire ERM framework should be 
assessed to see how well it’s working for the insti- 
tution. Needs change, staff change, the priorities of 
the institution change, and the ERM framework 
needs to change to keep up. 


Meanwhile, execution and follow-through are 

the point where many risk management plans fall 
apart. In its 2012 report on institutional risk man- 
agement, the Education Advisory Board states that 
three pitfalls often hamper effective implementa- 
tion: 


@ Plans lack accountability. Managers develop 
unachievable “pie-in-the-sky” plans without 
confirming if they could actually be executed, 
while lack of follow-through means plans get 
dusty sitting on office shelves. 


H Incentives are insufficient to spur unit-level 
action. Without institutional incentives and 
support, unit-level leaders don’t see risk mitiga- 
tion as a real priority. 


Inability to reallocate resources to institu- 
tional risks. Unless the cost for risk treatment 
efforts is estimated and budgeted, administrators 
have to guess how much money is needed and 
try to draw it from other sources. If the process 
is too difficult or the funds aren’t available, risk 
mitigation will fall by the wayside. 


The solution requires creating an ERM process in 
which plans are developed in cooperation with dif- 
ferent campus constituencies to ensure that they are 
practical and achievable, that accountability is built 
into the system, and that risk is adequately funded. 
Otherwise, mitigation plans will almost inevitably 
come up short. 


Plans should also include the creation and use 

of metrics so that progress can be measured and 
managed, says Gallagher Higher Education Prac- 
tice. “The metrics may address total cost-of-risk, 
claims trends, or other numerical measures,” they 
state in their report Road to Implementation: Enter- 
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Data Point: 
Enterprise risk management 


ERM on K-12 campuses: Case study in 
San Francisco 


When campus leaders broaden their focus to 
consider both risks and opportunities, new 
possibilities open up for colleges or universi- 
ties—and for K-12 school districts. 


For example, the San Francisco Unified 
School District (SFUSD) needed to better 
manage the risks and liabilities posed by 
community-based organizations working on 
school campuses. These community groups 
provide tutoring, mentoring, health, wellness, 
and after-school programs to San Francisco 
students. 


The district developed a process and work- 
flow for identifying and outlining contractual 
obligations and ensuring compliance with 
regulations requiring background checks, drug 
screening, and insurance. At the same time, 
driven by an ERM philosophy that incorpo- 
rated opportunity as well as risk, individual 
campuses were encouraged to assess the 
community organizations working in their 
schools. School principals were urged to 
determine if the work of community groups 
aligned with the priorities of the campus. 


“From a risk management perspective, what 
began as a focus on compliance (MOUs, insur- 
ance, etc.), expanded into an ERM model that 
provided support for strategic objectives and 
services to better serve the needs of students. 
It resulted in a process that was broader than 
simply managing risks through insurance or 
other similar risk tools.” 


Source: Excerpt from “Enterprise Risk Manage- 
ment in the Great City Schools,” Council of the 
Great City Schools, Spring 2016. 


prise Risk Management for Colleges and Universities. 
“Qualitative measures might include opinions 
about the impact of risks on the institution’s prog- 
ress in advancing its mission.” Senior leadership 
and board members should receive regular updates 
on risk metrics to ensure the institution is moving 
in the right direction. 


Boards and campus leaders also need to implement 
a process to ensure new risks rise to their 
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attention. Senior staff responsible for risk manage- 
ment, such as the Chief Risk Officer or equivalent, 
and any risk management teams on campus, need 
to stay on top of trends and issues and regularly 
survey outside experts for insight into emerging 
threats. Abraham also suggests going deeper into 
the institution by surveying a wider range of staff 
and faculty leaders. (She suggests asking the sim- 
ple but telling question, “What keeps you up at 
night?”) This approach can give the institution 
insight into risks senior administrators might not 
have realized were significant. 


One of the most important times to consider risk 
is when the college or university considers pursuing 
new initiatives. It’s easy to get caught up in the 
excitement of a new plan or program—and hard 

to put on the brakes if significant donor funding 

is involved—but the best time to assess risks is at 
the start of a project. Risk assessment should be 
incorporated into the campus planning process and 
employed by senior leadership and board members 
before signing off on new initiatives. 


Embracing opportunities 


We tend to think of unexpected circumstances 

as bad or dangerous things, and certainly they 

can create risks that threaten the college or uni- 
versity’s ability to achieve its mission. But new 
circumstances can also create opportunities that 
institutions can seize to advance their mission. 
Effective risk management, according to United 
Educators’ Janice Abraham, includes the flexibil- 
ity to respond to both negative and positive events 
and turn them to your institution’s advantage. 


It’s important to emphasize opportunity. Institu- 
tions are inherently cautious and averse to change. 
But leaving opportunities on the table in favor of 
the status quo is itse/fa risk. History is full of stories 
of organizations who came to regret letting oppor- 
tunities go. Remember that an engineer at Kodak 
invented the first digital camera. Kodak failed 

to capitalize on the invention, and the Eastman 
Kodak Company is now a shadow of its former self. 


Finding and assessing opportunities mirrors the 
steps of addressing risks: 


Identifying opportunities. Institutions should 
look for opportunities at the same time they seek 
out risks. Sometimes they are two sides of the 
same coin. A financial decline can threaten an 
institution’s goals, just as a financial upswing can 
jump-start them. Many risks create opportunities 
in their wake. The risks of creating a new scientific 
research program (e.g., “Will it attract enough 
students? Will it attract high-quality staff? Can we 
get donor support for renovations to existing facili- 
ties?”) must be balanced by potential opportunities 
(e.g., “We have a chance to establish ourselves in 
this new field and prepare students for a promising 
new career.”) 


Categorizing and ranking opportunities. An end- 
less list of opportunities is as useless as an endless 
list of risks. Opportunities should be ranked just 
like threats. Heat maps, for example, can assess the 
potential impact and probability of opportunities, 
and the most likely and high-impact opportunities 
should be given the most attention. 


Responding to opportunities. Institutions often 
feel little need to prepare as thoroughly for op- 
portunities. Certainly, a solid emergency plan is a 
greater priority, but if the institution sees an op- 
portunity on the horizon, it would be wise to be 
ready for it. For example, the campus might keep 
its eye on a declining shopping center adjacent to 
campus, understanding that traditional malls are 
closing down across the country. Even if the owners 
are currently committed to keeping the property, 
the institution could still include the property in 
its master planning process and consider what the 
college or university would do if it suddenly came 
available. 


Best practices for managing risks 
and opportunities 


Drawing on her experience helping college and 
university campuses across the United States 
identify and mitigate risks, Abraham presents the 
following as best practices for effective ERM: 


MH Start from the top. Champions are essential to 
making enterprise risk management a priority for 
your campus. And those champions need to be 
among the most senior leaders of the institution. 
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“You won't create a strategic risk management 
system if the president doesn’t care,” explains 


Abraham. 


Understand and embrace specific roles. No 
single individual can understand the complexity 
of an entire campus. Effective risk management 
programs rely on experts in different disciplines 
to guide the institution. 


Understand, respect, and appreciate differ- 
ences between business and education. Board 
members and other campus leaders from the 
private sector may want to push the college 

or university to a more business-based assess- 
ment of risk, but to do that is to misunderstand 
the nature of higher education. The safety of 
students and the academic reputation of the 
institution cannot be quantified with a simple 
dollar figure. 


Build on the work of others. “We all think 
we're unique. But we have more in common 
than we like to admit,” says Abraham. Colleges 
and universities don’t need to start from scratch 
developing lists of risks or creating assessment 
systems. Save time by studying the work of ex- 
perts and relying on the experiences of peers. 


Incorporate risk management into board com- 
mittees and the full board’s work. The board 
needs to ask questions, require regular updates, 
and establish accountability for risk. 


Question sacred cows. Every institution has 
them, and the tendency is to not look too closely 
at them. But how often has the greatest damage 
to an institution’s reputation—let alone damage 
to human lives—emerged from deeply beloved 
individuals and well-entrenched campus or- 
ganizations? No one should be above scrutiny. 
The beloved coach, the championship team, the 
Nobel Laureate, the favorite professor—all need 
the same attention. Failure to question these sa- 
cred cows leaves institutions vulnerable and does 
their students, faculty, and staff a disservice. 
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Data Point: 
Enterprise risk management 


Tips from United Educators and the 
Association of Governing Boards of 
Universities and Colleges 


1. Define risk broadly. Risk should include any 
impediment to accomplishing institutional 
goals. 


2. Recognize both the opportunities and 
downsides of risk. Weigh risks against 
potential rewards and remember that all 
successful organizations take risks. 


3. Develop a culture of evaluating and identi- 
fying risk at multiple levels. Presidents and 
board members rarely see the first warning 
signs of emerging risks. Draw on the in- 
sights of multiple levels of the institution to 
get the big picture. 


4. Look at the total cost of risk. Risk is not just 
about dollars and cents. Institutions must 
consider all consequences of risk, including 
lost productivity, distraction from mission, 
and negative publicity. 


5. Emphasize collaboration between boards 
and presidents. Presidents and boards need 
to engage in candid discussions at the stra- 
tegic level and work together to fulfill their 
shared responsibility for the success of the 
mission and the stability of the institution. 


Source: Adapted from Association of Governing 
Boards of Universities and Colleges and United 
Educators, “The State of Enterprise Risk Man- 
agement at Colleges and Universities Today,” 
AGB, 2009. 
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Section 3: 


Strategies for Responding to Major Risk Categories 


tunities currently faced by their institutions, 

participants at the 2018 Thought Leaders 
symposium conducted their own heat map exercise. 
They evaluated threats and opportunities by poten- 
tial impact and probability, and focused attention 
on the top major risk categories that emerged from 
the exercise: 


| o get a sense of the types of risks and oppor- 


1. Revenue and investments 
2. Brand and reputation 

3. Health and safety 

4. Innovation 

5. Facilities 

6. 


Changing political/cultural environments. 


Participants then discussed each category in depth 
and proposed strategies that institutions can use to 
mitigate these risks. 


1. Revenue and Investments 


Colleges and universities have faced unprecedented 
financial upheaval in the last 20 years, and the situ- 
ation remains uncertain. While state appropriations 
for higher education rose nationwide by 2.1 percent 
between 2016 and 2017, public colleges and univer- 
sities are relying heavily on tuition to make up for 
ground lost in the Great Recession, according to 
the annual State Higher Education Finance report. 
A symbolic line was crossed in 2017, when more 
than half of states relied more on tuition dollars 
than public appropriations. In 2008, net tuition was 
only 35.8 percent of total education revenue across 
U.S. public education; in 2017 it accounted for 
46.6 percent. 


These figures are only a single data point in the 
evolving picture of higher education financing, 
which no one expects to stabilize anytime soon. 
Colleges and universities of all types and sizes— 


from sprawling suburban community colleges to 
small private liberal arts institutions, and from 
massive land-grant state flagship campuses to his- 
torically black colleges and universities—must be 
prepared to adapt to the changing economic envi- 
ronment. 


Thought Leaders participants outlined several steps 
their institutions are already taking. These include: 


Ramping up fundraising. 

Striving for competitive tuition rates. 

Managing endowments. 

Controlling costs. 

Strengthening recruitment and retention efforts. 

Experimenting with new course delivery 

methods, including new campuses and online 

instruction. 

M@ Increasing the institution’s flexibility to deal with 
market demands. 

HM Assessing the long-term viability of non-revenue 

generating programs. 


Then participants looked at new strategies that 
more colleges and universities should consider 
going forward: 


B® Adopting differential pricing. 

@ Making it easier for students to transfer credits. 
@ Reducing the time to a degree. 

M@ Better managing indirect costs. 

B Leveraging real estate investments. 


None of these risk mitigation strategies are them- 
selves without risk. For example, differential pricing 
is spreading across campuses, particularly in public 
research universities, according to the report “Un- 
masking College Costs: Challenges in the Era of 
Differential Tuition Practices,” published by the 
American Educational Research Association (re- 
searchers Glen R. Nelson, Gregory C. Wolniak, 
and Casey E. George). The report found that 86 
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out of 143 surveyed public research universities 
charge students different prices based on their 
major and their year of study. Tuition prices can 
vary by 40 percent or more. These price increases 
cover the additional cost to the institution of pro- 
grams such as engineering, studio art, and nursing, 
and allow inexpensive courses, such as those in the 
humanities, to remain at their traditional rate. But 
differential pricing can be a blow to students who 
don’t expect it, and students complain that colleges 
and universities have made little effort to explain 
the extra fees and higher costs per credit hour, so 
that the higher price only becomes clear when the 
bill arrives. It’s unclear if differential pricing hurts 
enrollment or graduation rates; university leaders 
questioned in AERA’s report say they’ve seen no 
difference. On the other hand, a separate analysis 
by a University of Michigan researcher in 2013 
found that differential pricing in an engineering 
program may have lowered the number of women 
and minority students who enrolled. Critics also 
maintain that differential pricing practices exert 
negative pressure on some fields, such as technol- 
ogy and medicine—fields for which states and 
institutions should be encouraging student en- 


Data Point: 
Disrupted revenue 
Hope and denial are not strategies 


“Today a great many American colleges and 
universities— ranging from those that, at least 
for now, seem reasonably secure to those 
that are hanging on by just a slight financial 
thread—are faced with a series of threats. 
Some institutions are involved in thought- 
ful, data-informed, and effective planning, 
but others are not directly confronting such 
challenges and are failing to engage in such 
planning.... 


“Ultimately, institutions cannot predicate their 
planning on the hope that, in time, external 
realities will change, and they will once again 
regain their previous stability. Nor can they 
deny external realities and their own circum- 
stances. In short, they must understand that 
hope and denial are not strategies.” 


Source: Susan Resneck Pierce, “Hope and 
Denial are Not Strategies,” /nside Higher Ed, 
January 31, 2017. 


PE AGD cE eRe ome o cbr Ines 


2018 


rollment, in order to meet broader societal needs. 
Clearly, the benefit of financing costly degree pro- 
grams must be balanced with the risks. 


2. Brand and reputation 


The risks to a college or university’s reputation 

are impossible to list and have the potential to be 
uniquely damaging. Decades of hard work building 
a solid brand can be undone in an instant by the 
work of a single bad actor. It’s easy to assume that 
it couldn't happen to you—but that’s a dangerous 
assumption. Smart institutions prepare for the 
“unknown unknowns”’—those factors that can 
bring your college or university to its knees—by 
emphasizing individual accountability and putting 
mechanisms in place that can be activated in a 
worst-case scenario. However, in a recent survey 
by United Educators, only 26 percent of partici- 
pants believed that their institution’s response to 
reputational risk is consistently proactive, while 54 
percent believed they did not have the ability to 
withstand a major reputational risk event. 


Thought Leaders participants looked first at what 
institutions are already doing to safeguard their 
brand and reputation: 


M Hiring effective public information and commu- 
nications teams to manage brand and identity. 

M Educating campus stakeholders on brand and 
reputation. 

M@ Investing in the community to build an “ac- 
count” of trust that can be drawn upon in tough 
times. 

HM Implementing controls and systems that create 
accountability throughout the institution. 


Going forward, participants believed colleges and 
universities need to take further steps to protect 
their reputations, including: 


M@ Establishing a monitoring system—especially 
for social media—to track emerging reputational 
damage to the institution. 

HM Identifying owners and lines of communication 
for specific reputational risks. 

M Improving the culture of the institution by artic- 
ulating the values and mission of the college or 
university, communicating clear expectations for 
behavior, and ensuring transparency. 
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@ Focusing attention on the sacred cows on cam- 
pus, those individuals or programs that are 
perceived to be above reproach, and reminding 
the campus that no one can act without account- 
ability. 

@ Preparing communications strategies and mit- 
igation plans to implement in the event of a 
reputational crisis. 


The best reputational risks are those that are 
avoided. “People understand that crises are going to 
happen,” said Gene Grabowski, senior vice presi- 
dent at Levick Strategic Communications, LLC, in 
Washington, DC, “It’s the cover-up that’s optional” 
(“Penn State Scandal Sharpens Focus on Reputa- 
tional Risk,” Business Insurance, Mike Tsikoudakis, 
January 1, 2012). In many of the recent scandals 
that have damaged institutional reputations, the 
warning signs were there. In some of the most 
disturbing sexual assault cases, individuals reported 
concerns or even outright offenses for years before 
they were taken seriously. Institutions need rules for 


Data Point: 
Reputation risk management 


Need for crisis communications 
expertise 


“The complexity and intensity of some of the 
most prominent scandals to hit higher educa- 
tion require expertise in response that is well 
beyond any campus. John Burness, visiting 
professor of public policy at Duke University, 
notes, “No campus is prepared for the media 
spotlight that accompanies a crisis of the size 
and scope that occurred at Duke University 
or Penn State. Even the most experienced 
campus public relations staff need outside 
help.” The need for immediate responses—via 
multiple channels—and the viral potential of 
events and any additional missteps calls for 
specialized expertise beyond the experience 
and talent of internal staff. Having an external 
communications firm or consultant familiar 
with the institution, its culture, and its circum- 
stances can provide much-needed additional 
support for managing the message in the 
midst of a crisis.” 


Source: Janice M. Abraham, Risk Management: 
An Accountability Guide for University and Col- 
lege Boards, AGB, 2013. 


conduct, procedures to deal with misconduct, and 
reporting systems that take victims seriously. 


3. Health and safety 


The greatest challenge to ensuring the health and 
safety of students, faculty, staff, and visitors is that 
the risks never stop coming. Every day seems to 
bring new hazards, which can range from rowdy 
crowds at the biggest basketball game of the year to 
slippery tile floors in residence hall showers, volatile 
gases in a chemistry lab, and students driving under 
the influence. It doesn’t take much to put lives 

at risk. 


Participants at the Thought Leaders symposium 
felt their campuses were taking solid steps toward 
managing health and safety, with their existing ef- 
forts including the following: 


MH Responding to requirements of accreditation 
agencies and regulations. 

M@ Incorporating risks raised by recent headlines 
and events into their risk management plans. 

MH Conducting tabletop exercises to test and 
improve response procedures and crisis manage- 
ment plans. 

M Creating and regularly revisiting policies and 
plans. 

MH Educating the community about risks. 

MH Engaging with local law enforcement. 


Nevertheless, participants believed their institu- 
tions could be more proactive in managing health 
and safety risks. They emphasized the following 
steps going forward: 


M Addressing emerging risks before they reach the 
headlines. 

MH Conducting better assessments to predict risks. 

M Seeking out funding to use better technology to 
predict and respond to crises and to increase staff 
levels. 

M@ Increasing transparency to campus stakeholders 
about risks. 

MH Conducting more mandatory training to prepare 
a wider group of campus staff and leadership. 

HM Simplifying risk response strategies so that 
individuals know what to do in a variety of cir- 
cumstances instead of creating enormous binders 


full of detailed plans. 
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Taking a proactive approach to risk management 
can mean flipping the question from “What risks 
do we need to fear?” to “What would a safe and 
healthy situation look like, and how do we move 

in that direction?” For example, participants in a 
Gallagher Higher Education Practice think tank 
focused on risks to student health by asking, “What 
defines a healthy student?” The report considered 
the importance of student health to the institu- 
tion’s mission, the availability of student health and 
mental health services, and the impact of chang- 


Data Point: 
Institutional risk 
The risk of minors on campus 


“In the aftermath of the 2011 Jerry Sandusky 
child sexual abuse scandal that rocked the 
higher-education community, colleges and 
universities across the nation began realizing 
that they were not fully aware of just how big 
and dangerous a risk they were embracing in 
offering programs for minors. In the wake of 
this realization, universities across the nation 
have been hard at work to evaluate, develop, 
and implement system-wide changes. And 
through this work, many universities discov- 
ered that seemingly simple questions such as 
‘How many minors do we serve on campus? 
In which programs are we serving minors? 
What safeguards do we have in place to pro- 
tect minors?’ are not so easily answered. 


“Many universities began by attempting to 
quantify their exposure but quickly realized 
they lacked a process to identify and track all 
youth-serving programs, and were unable 
to determine the actual number of minors 
served. Those universities that were able 

to get an estimate were surprised—even 
shocked—to realize that they actually served 
far more minors than university students. 
Between summer camps, recreation events, 
childcare, laboratory research, mentoring 
programs, 4-H, campus tours, and community 
outreach, the numbers kept growing. 


“Today, university awareness of this risk has 
increased tremendously and most have begun 
systematically addressing the exposure.” 


Source: Candace Collins, Richard Dangel, and 
Aaron Lundberg, “Six Lessons Learned in Man- 
aging the Risk of Minors on Campus,” 2014 
URMIA Journal Reprint. 
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ing demographics on students and their health. 
(Demographics matter because international 
students, minor students, older students, and vet- 
eran students may face different health challenges 
than traditional students.) The report concludes 
by recommending that institutions create student 
health advisory committees, provide special health 
services for at-risk and economically disadvantaged 
students (who may arrive on campus with existing 
health challenges), and target healthcare outreach 
to international students. 


This is only one example, but similar steps can be 
taken with other health and safety issues. Envision- 
ing the best laboratory safety program or the most 
effective response to an outbreak of flu on campus 
can help expose where reality falls short and be the 
first step in creating a safer, healthier institution. 


4. Innovation 


The pressures on higher education demand re- 
sponse from colleges and universities, who must 
innovate to survive. This pressure has grown over 
the last two decades, but innovation remains in- 
credibly difficult for many institutions. Resistance 
to change, combined with the inherent difficulty of 
steering a new direction for vast higher education 
organizations, has left senior leaders struggling to 
successfully innovate. 


Participants in the Thought Leaders symposium 
reported that their institutions were taking steps to 
promote innovation, including the following: 


MH Engaging in professional development conver- 
sations with peers to share innovative strategies 
and successes. 

Creating innovation grants to encourage innova- 
tion within the classroom. 

Updating search processes to select creative and 
innovative job candidates. 

Developing new degree programs and course 
delivery methods. 

Building partnerships with community colleges. 
Increasing cooperation with businesses to sup- 
port job placement of graduates. 


Areas where participants believe their institutions 
could advance innovation include the following: 
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@ Developing a clearer picture of effective innova- Colleges and universities must hedge against 
tions in pedagogy. risks even while taking risks. If new initiatives 
@ Using data more effectively and embracing busi- are truly risky and disruptive, not all will suc- 
ness intelligence to support decisions. ceed. Some, in fact, will go down in flames. “A 
@ Taking a hard look at tenure and promotion risky innovation that pays off is the holy grail we 
from the perspective of doing the best for our all seek. Until you find it, don’t risk losing the 
students. only thing that’s supporting your quest,” Strik- 
Bi Investing in student success. werda says. That means protecting successful 
traditional operations from the fallout of any 
Carl J. Strikwerda, president of Elizabethtown failures. 
College in Pennsylvania, points out that two com- 
peting and even contradictory management trends MH Enterprise risk management is the reverse 
are currently dominating discussion in higher of, and complement to, strategic planning. 
education: risk and innovation (“Risk Managing Strategic planning rises in importance the more 
or Risk Averse? Neither Approach is Fully Suited ambitious and innovative an institution’s under- 
for Higher Education,” The Chronicle of Higher takings become. Colleges and universities should 
Education November 10, 2014). On the one hand, go into new initiatives with their eyes open to 
institutions have become more aware of the risks both the risks and opportunities. That doesn’t 
that threaten their operations and reputations mean that all risks can be predicted—there will 
and are embracing enterprise risk management always remain the “unknown unknowns.” Strik- 
to mitigate those threats. At the same time, many werda notes, “The new directions toward which 
college and university leaders believe that disruptive the institution is headed are the most likely areas 
change is the path to success. “We have, in other in which unanticipated risks will happen and 
words, two views of risk before us: as a threat to also the ones with the most potential to free the 
be warded off and as a value to be celebrated,” says institution from the constraints of scarce re- 
Strikwerda. sources.” 
How to balance these competing impulses? Strik- H Disruption is a side effect of innovation, 
werda suggests the following strategies: not a goal. Innovation can be disruptive, but 
that doesn’t mean that disruption is always 
H Institutions should never “bet the rent innovative. New initiatives should be carefully 
money.” Embracing innovation doesn’t mean thought-out and well-executed, not thrown 
ignoring risk—it means confronting it head on. together in the hope that innovation will arise 


Data Point: 
Institutional risk 
Working toward compliance with Title IX 


The requirements of Title IX pertaining to sex- multiple other hats. On some campuses, Title 
ual harassment and sexual violence remain so IX has its own office, while in others Title IX 
complicated for institutions that even the web- falls under student affairs, human resources, 
site of the professional association of Title IX or risk management. 


administrators admits, “Title IX compliance is 
all over the map,” adding, “We're still not en- 
tirely sure what the appropriate role, functions, 
and expectations of coordinators are.” 


It’s also difficult for colleges and universities 
to predict where Title IX will go. “The min- 
ute we get our brain around what Title IX is, 
it changes,” says Brett Sokolow, executive 


Some institutions have teams of more than director of the Association of Title IX Admin- 
a dozen people working full-time on Title IX, istrators. In such an uncertain environment, 
while others have one person who might wear institutions must walk with care. 


Source: Excerpts from Jennifer Fink, “Untangling Title IX in Higher Ed,” University Business, May 2017. 
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spontaneously out of chaos. Strikwerda says, 
“Create the best-thought-out, promising new 
initiatives, whether or not they're disruptive, but 
don’t seek disruption for its own sake.” 


While it may seem that higher education is a 
deeply conservative and entrenched industry, 
Strikwerda asserts that “the most successful col- 
leges in America have continued decade after 
decade to innovate—developing computer science, 
undergraduate research, environmental studies, 
neuroscience, community-based learning, interfaith 
understanding, and, yes, online education—while 
nurturing their best traditions.” He continues, “Ac- 
ademe has its own special challenges and its own 
special strengths. We have too often been better at 
fostering our core operations than branching out in 
new ways. Yet we have also done well blazing our 
own path that builds on our strengths.” 


5. Facilities 


The buildings, grounds, and infrastructure in which 
higher education operates carry risks that colleges 
and universities must manage. A well-prepared 
and risk-savvy facilities operation can soften the 
blows of natural disasters and prevent or contain 
threats to health and safety. At the same time, 
facilities failures can disrupt institution opera- 

tions like nothing else. A power outage or water 
main break can bring college or university life to a 
screeching halt. 


Thought Leaders participants described their 
institutions as taking many positive steps toward 
managing facilities risk, including the following: 


@ Planning for power outages by investing in 
power generation and creating campus micro- 
grids. 

@ Partnering with utilities to keep the campus op- 
erational under a variety of circumstances. 

@ Lobbying for state funding (for public in- 
stitutions) to update outdated facilities and 
infrastructure. 

@ Creating performance-based service contracts to 
share risks. 

H Implementing Total Cost of Ownership 
standards to ensure that long-term maintenance 
of facilities is considered during planning and 
design. 
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M Educating stakeholders on the role of facilities 
in student success in order to make the case for 
facilities investment. 

HM Creating, testing, and revising emergency man- 
agement and business continuity plans. 


Participants also considered where they could do 
better: 


Making better use of existing space through 
strategic space optimization. 

Investing in condition assessments of existing 
facilities. 

Making building commissioning part of every 
new project. 

Moving toward predictive rather than reactive 
maintenance and energy management. 
Educating senior institutional leaders on facili- 
ties issues, including Total Cost of Ownership. 
Expanding professional development for facili- 
ties staff, and sharing successes and best practices 
with peers. 


Total Cost of Ownership (TCO) was a recurring 
theme in the discussion of minimizing facilities 
risks and can play a significant role in reducing 
facilities risk. The TCO concept optimizes finan- 
cial investments by evaluating the “comprehensive 
impacts of a specific asset decision on the entire 
facility and infrastructure of an organization from 
inception onward,” according to APPA’s standard, 
APPA 1000-1: Total Cost of Ownership for Facilities 
Asset Management. “This applies to future expen- 
diture decisions but also to the continuing cost of 
ownership of existing assets that aid in the determi- 
nation of repair, renewal, or replacement decisions.” 
The benefits begin during construction and ex- 
tend as long as the facility is in use. For example, 
low-cost materials or systems may look good on 
paper (i.e., first cost or least cost), but if materials 
are cheaper because they are of lower quality, they 
may increase the risk of injury during construction 
and create regulatory risks if their performance 
standards are low. Furthermore, cheap materials 
can increase maintenance costs, posing risk to the 
facilities budget, and create operational risks if ma- 
terials or systems fail. In other words, a cheap air 
conditioning system isn't really cheap if it goes out 
during the hottest week of the summer and shuts 
down all summer classes. Making the best decisions 
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for the life cycle of a building reduces risk by ensur- 


ing quality materials and systems that will operate 
efficiently over the long term. 


6. Changing cultural/political 
environments 


Some of the most challenging risks to higher edu- 
cation are those arising from political and cultural 
change. They imperil the institution because they 
are hard to predict and hard to assess—it’s difficult 
to envision how the installation of a new Secre- 
tary of Education will affect an individual college 
or university campus. Yet no one doubts that a 
new Secretary can have a dramatic impact. These 
challenges require institutions to be adaptable, 
flexible, and attentive. 


Institutions work to remain on top of cultural and 
political changes through the following mecha- 


nisms: 


@ Monitoring of large-scale economic trends by 
financial experts. 

@ Tracking of political change on both a state and 
national level by public affairs experts. 

@ Analysis of regulatory changes by national and 
international higher education professional 
associations. 


However, colleges and universities need to expand 
their assessment of cultural and political risks, 
through steps such as the following: 


@ Assigning owners to broad areas of political 
and cultural change and making those owners 
responsible for monitoring, assessing, and re- 
porting on trends. 

@ Creating or strengthening relationships with 
professional associations that track trends affect- 
ing higher education. 

@ Conducting “what if? exercises on newspaper 
headlines to see how they could affect the 
campus. 


For an example of “what if” exercises based on 
newspaper headlines, look at the trend toward 
widespread adoption of ride-share services, the 
rapid development of self-driving vehicles, and the 
declining rate of driving among younger Ameri- 


Data Point: 
Institutional risk 


Immigration policies threaten U.S. 
higher education 


“University leaders are concerned about how 
federal government policies are affecting 
higher education in the U.S., one prominent 
university head told CNBC. 


“Max Nikias, president of the University of 
Southern California, discussed the education 
sector's fears for overreaching regulation by 
the government. 


“"There hasn’t been a major impact yet, but 
it’s something we’re concerned about... .,’ 
he said. 


“The Trump administration’s perceived hostil- 
ity to immigration and what that might mean 
for international student enrollment in U.S. 
universities is a particular point of worry for 
the educational establishment. 


“Donald Trump’s presidency has been seen in 
part as a result of a mounting backlash against 
immigration with opponents of increased in- 
ternational arrivals believing that they could 
take jobs from American citizens... . 


“According to a report published last year by 
the Institute of International Education, new 
foreign enrollment in American universities 
was about 291,000 in 2016—a 3 percent drop 
from the previous year, representing the first 
backtrack in growth the organization has 
recorded since it first started tracking those 
figures. 


“It separately received feedback from 500 
schools in the fall of 2017 who reported an 
average 7 percent drop in new international 
enrollment, though the researchers said it was 
too soon to know whether the ‘Trump effect’ 
is squarely to blame.” 


Source: “American Higher Education at Risk 
from Immigration Policies, Says USC President,” 
CNBC, February 21, 2018. 


cans. Colleges and universities have designed their 
campuses specifically to accommodate cars. If these 
trends hold and car use and ownership decline 
markedly, what will institutions do with all of those 
parking lots and parking garages. What if? 


IES) 
22 


APPA THOUGHT LEAD 


It’s particularly important to consider the oppor- 
tunities as well as the risks posed by broad cultural 
and political trends. In the above example, a cam- 
pus can probably think of many exciting uses for 
the space now taken up by parking garages. 


A comprehensive list of trends and issues institu- 
tions should consider alongside traditional threats 
is probably impossible to develop, but the following 
issues should be among those most institutions 
consider: 


@ Cyberattacks in general and ransomware 
attacks that can hold institutional data hostage 
in particular. 

@ Changing transportation technologies and 
trends. 

H Unionization of graduate students and faculty. 
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Changing expectations from students, parents, 
and government agencies. 

Demographic shifts reducing the size of the 
population under age 25 and increasing minority 
populations. 

Shifting attitudes toward immigration, including 
those that might place new limits on interna- 
tional student visas. 

Concerns about head trauma in contact sports. 
Shifting perceptions about athletics in general. 
The #MeToo movement. 

New focus on sorority and fraternity hazing and 
drinking. 

Free speech concerns conflicting with public 
protests against controversial speakers. 

Student mental health concerns. 

Evolving debate on gun safety and con- 
cealed-carry laws. 
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Section 4: 


Institutional Risk and the Facilities Organization 


urning attention to higher education facilities, 

the staff and leadership of the facilities organi- 

zation play a large role in helping the campus 
prepare for and respond to risks. Facilities experts 
often think about risk as much as any Chief Risk 
Officer—they are regularly engaged with questions 
of how to manage building systems failures, prepare 
for outages, and conduct preventive maintenance to 
extend building life. 


Role of the facilities organization in 
managing risk 


Participants at the Thought Leaders symposium 
separated into groups based on their role at their 
colleges and universities to better understand how 
the facilities organization can support their insti- 
tutions’ ERM efforts. Three groups—security and 
risk managers, academic affairs and student affairs, 
and CEOs and CFOs—considered the question: 
What do you need from facilities to respond to 
risks? 


Security and risk managers. Risk experts said one 
of the most important roles of facilities is to be the 
eyes and ears of the campus. Facilities staff such 
as groundskeepers and custodians are everywhere 
on campus, all the time. For example, they might 
be the first to notice that a student is behaving in 
an unusual way, perhaps showing signs of serious 
depression. The facilities organization needs to en- 
courage and empower staff to keep their eyes open 
and give them an easy way to report what they’ve 
noticed. 


The second request of security and risk managers is 
for better cooperation with facilities staff. When 
risk managers can be involved with the planning, 
design, and construction of buildings, they can 

add input that will make it easier down the road to 
secure these buildings. Relatively straightforward 
design choices, such as ensuring sight lines and 


providing good lighting, are easy up front but diffi- 
cult to correct once a project is complete. 


Academic and student affairs. Experts in academic 
and student affairs say they look to facilities as 
content experts. The dean of students or provost of 
a campus likely has little formal knowledge about 
how to manage facilities to reduce risk. They need 
help understanding challenges and developing 
strategies to minimize threats and maximize stu- 
dent health, safety, and academic success. Effective 
institutions build partnerships with the facilities 
organization and their academic and student affairs 
counterparts. 


CEOs and CFOs. Senior financial and managerial 
leaders on campus also rely on the expertise of the 
facilities organization. They look to senior facilities 
officers to keep campus leaders informed of the 


Data Point: 


Institutional risk and the facilities 
organization 


Facilities risk case study: University of 
Washington 


With 49 percent of the facilities on the Seattle 
campus of the University of Washington 50 
years or older, the institution’s ERM program 
identified aging infrastructure and operational 
systems as one of its top risk areas. The 2013- 
14 ERM Report noted, “Older facilities present 
potential safety risks, energy inefficiencies, 
and technology that does not meet current 
operational and program needs.” The report 
detailed several top risks and their mitigation 
focus, including an improved prioritization 
approach for deferred maintenance and en- 
hanced debt-financing approaches. 


Source: Excerpt from “University of Washington 
Enterprise Risk Management (UW-ERM): 2013- 
2014 Annual Report.” 
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needs of the campus in terms of facilities risks, as 
well as strategies for addressing environmental and 
sustainability challenges. Facilities leaders are also 
uniquely able to inform staff about changing regu- 
lations and how the campus needs to respond. 


Facilities can also support financial leaders in 
making the case for facilities investments. CEOs 
and CFOs recognize that preventive maintenance 
and strategic facilities renewal reduce the risk of 
building and infrastructure failure, but they need 
help proving their point. Facilities leaders can pro- 
vide the hard data that convinces boards to invest 
in long-term facilities funding. 


How the facilities organization 
can support the institution in 
managing risk 


Facilities participants at the Thought Leaders sym- 
posium looked at risk from the other side of the 
equation: What can the facilities organization offer 
higher education to manage and mitigate risk? 


The Senior Facilities Officers in attendance listed 
numerous ways their organizations serve their in- 
stitutions: 


H Hands-on, in-depth knowledge of the campus 
built environment. Facilities staff have been in 
every corner of the campus, including the utility 
tunnels, sub-basements, and attics where no 
president, board chair, provost, or dean has ever 
gone. This sort of knowledge is critical in miti- 
gating risks and managing disasters. If a blizzard 
is about to hit, or 20,000 fans are showing up 
for the big game, the preparations of the facili- 
ties organization will keep the campus running 
smoothly. 


@ A responsive staff. The facilities organization 
is one of the largest on campus, and one of the 
most responsive. Staff are accustomed to being 
sent out to mop up spills, repair broken sinks, 
and diagnose power interruptions. It’s only one 
more step to respond to emergencies. 
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M Eyes on the ground. Facilities leaders agree 
with security and risk managers that this is one 
of the organization’s strengths. The facilities 
organization is an embedded workforce, closely 
engaged with the operations of the rest of the 
campus and alert to changes. They can and do 
speak up when they recognize unusual or alarm- 
ing behavior. 


Facilities participants were also divided into groups 
by the size and type of their college or university to 
see how different Carnegie Classifications would 
respond to the question. While there was signifi- 
cant overlap in the answers, a few differences 

stood out: 


MH Private colleges and universities. Represen- 
tatives of private institutions emphasized the 
strong relationships they’ve formed with the 
local community. Campuses have worked with 
local governments and built good town/gown 
relationships, the sort of relationships that bene- 
fit the institution in the case of a natural disaster 
or crisis. Facilities organizations also have con- 
nections with local vendors and subcontractors 
that they can draw upon when needed. 


H Public research institutions. Participants from 
large public colleges and universities pointed to 
the strength of partnerships with research faculty 
on their campuses. The facilities organization 
can serve as a living lab in cooperation with 
engineering, architecture, planning, and environ- 
mental programs, just to name a few. 


H Smaller public institutions. Representatives 
from smaller public colleges and universities 
highlighted the facilities organization’s famil- 
iarity with cross-functional teams. While many 
units of the campus tend to congregate in silos, 
facilities must work across disciplines every day. 
As well as forming teams of planners, architects, 
designers, and engineers, facilities organizations 
regularly work with the finance organization to 
fund new projects, with the IT organization to 
integrate technology, and, of course, with risk 
management to assess and mitigate risks. 
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Data Point: 
Risk and the facilities organization 


How much time is devoted to risk assessment? 


Almost none 


Perhaps an 
hour or two 


Five hours 
per week 


More than 
five hours 


0% 10% 20% 


30% 


40% 50% 60% 70% 


Source: APPA Thought Leaders Risk Survey, January 2018. 


Filling the gaps a 
When Thought Leaders symposium participants 
compared what the institution needs from facilities B 
with what facilities has to offer, they identified a 

few gaps between the two. To close these gaps, the 

facilities organization needs to take the following a 

steps: 

@ Hire insightful and empathetic leaders and em- 
ployees that can communicate the strengths and 5 
limitations of their department and discipline. 

@ Collect data and provide analytics, metrics, and al 


benchmarks to the campus community. 


M@ Include a wide range of campus stakeholders in 
the decision-making processes. 


The APPA Thought 
Leaders Risk Survey 
found that for the 
majority of Senior 
Facilities Officers, risk 
management takes up 
about an hour or two 
of every week. 


80% 90% 100% 


Build a customer-service minded, response- 
oriented workforce. 


Create opportunities for feedback from students, 
faculty, and staff. 


Emphasize a facilities culture that is integrated 
into and engaged with the broader campus com- 
munity. 


Help senior campus leaders build the case for 
investment in facilities renewal. 


Formulate a succession-planning strategy to 
ensure continuity and prevent the loss of critical 
facilities information. 
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Risks and Opportunities for the 
Higher Education Facilities Organization 


enior Facilities Officers are responsible for 

preparing for both risks to the college or 

university as a whole and to the facilities 
organization in particular. Facilities leaders par- 
ticipating in the Thought Leaders symposium 
conducted their own risk identification and assess- 
ment process to discover the risks and opportunities 
facing facilities. 


The risks with the highest probability and highest 
potential impact were as follows: 


®@ Financial shortfalls and facilities failures 
H Natural disasters 


Data Point: 


@ Lack of a qualified workforce 

MH Technology failures 

HM Utility failures 

HM Compliance issues 

H@ Institutional curb appeal/first impression. 


The opportunities with the highest probability and 
highest potential reward were as follows: 


MH Energy conservation 

MH Fuel and utility strategies 

M Green technology 

MH Facilities supporting student success 
HM Resources to respond to emergencies. 


Data Point: Facilities risk and opportunities 


Heat maps from the Thought Leaders symposium 


Risk Assessment: 


10 


Financial Shortfalls / 
Facilities Failures 


Lack of 
Capital Renewal 
e Failures 


e 
Commodity 
Volatility 


Employee Safety @ 


Impact: Low to High 
o 


Changing 


Pedagogy * 


Environmental 
Hazards 


Technology 


Compliance 


@ First Impression 


@ Pace of Change 


Senior Facilities 
Officers at the 
APPA Symposium 
conducted risk 
and opportunity 
assessment 
exercises, with the 
mapped results to 
the left and on the 
following page. 


@ Natural Disasters 


@ Lack of Qualified 
Workforce 


@ Utility Failures 


@ StaffTurnover 


e 
Failure to Conduct 


Preventive Maintenance 


0% 50% 
Probability: Low to High 


100% 


Source: APPA Thought Leaders Risk Survey, January 2018. 
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Opportunity Assessment: 


10 These two charts 
(Risk Assessment 
and Opportunity 
Assessment) focus 
on the highest 
@ Green Technology probability and 

Raise highest impact risks 
Employee @ coe 

Skills and opportunities. 

@ Fuel / Utility Strategy 


Resources to 
Respond to e 
e Building Emergencies Energy 
Automation e Conservation 


Space 
Optimization 


Total Cost » 
of Ownership 


Workforce 


Development 


Reward: Low to High 
o 


0% 50% 
Probability: Low to High 


Source: APPA Thought Leaders Risk Survey, January 2018. 


Greatest risks to the facilities 
organization 


Financial shortfalls and facilities failures. Inade- 
quate funding for campus facilities can have lasting 
implications for the college or university. Failure to 
invest in the built environment means that main- 
tenance issues pile up, easy fixes deteriorate into 
significant failures, and the whole campus drags 
along on the edge of catastrophe. Institutions where 
funding has been cut short year after year remain 
operational only with the nonstop work of facilities 
staff, who hunt down parts for antiquated equip- 
ment on eBay and position buckets under drips 
every time it rains. This poses a huge risk to both 
the facilities organization and the institution as a 
whole. What will the campus do when the aging 
heating system finally fails—and fails catastroph- 
ically on the coldest day of the year? Financial 
shortfalls create both operational and strategic 
risks for colleges and universities and threaten the 
institutions’ ability to fulfill its mission. 


Mitigation strategies suggested by Thought Lead- 
ers participants include the following: 


® Conduct Facility Condition Assessments so you 
know where you are and what you need. 


Strategic 
Plan Alignment 


100% 


M Communicate the real risks to senior campus 
leadership in terms they understand. 

M Change the dialogue away from talk of deferred 
maintenance (the term has too much baggage) 
and toward the idea of strategic renewal and re- 
investment. 

HM Identify the most pressing needs, prioritize solu- 
tions, and put the costs in terms of risk 
mitigation. 

M@ Design new structures and systems using Total 
Cost of Ownership standards so long-term costs 
are manageable and predictable. 

HM Investigate options for alternative financing 
methods to expand options for the campus. 


Natural disasters. Earthquakes, hurricanes, bliz- 
zards, floods, fires—everything the planet can 
throw at you, higher education campuses have 
endured. To some degree, natural disasters can 

be predicted. The University of Florida should 
anticipate hurricanes, the University of North 
Dakota blizzards, and the University of California 
earthquakes—and there’s not much point in North 
Dakota worrying about earthquakes or Florida 
prepping for blizzards. But disasters can and will 
strike out of season and where least anticipated. 
The best strategy is to be prepared for chaos, 
whatever its source. 
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Thought Leaders participants proposed the fol- MH Develop simple and straightforward plans for 
lowing strategies for managing the risk of natural response and recovery. 
disasters: M@ Perform drills, simulations, and tabletop exer- 


cises to rehearse plans and anticipate roadblocks. 
H@ Assess the probability of potential disasters. 


H@ Design structures and systems to be resilient to Lack of a qualified workforce. The number of 
failure and easy to repair. people qualified to work in higher education fa- 

@ Establish a clear incident command structure cilities is in decline. Researchers have found that 
and communications protocol. the profession as a whole “desperately needs influx 


of new blood,” according to the International 

Facilities Management Association. At the same 
Data Point: time, institutions are facing labor shortages in 
Facilities risks skilled trades. Across the facilities organization, 
the workforce is aging, senior staff are retiring, 


Confronting catastrophe: Business and colleges and universities are struggling to fill 


continuity planning open positions. 
In her chapter for NACUBO’s College and ar 
University Business Administration, Janice These shortages threaten institutions, who need 
Abraham notes that it can be difficult to see teams with skill and experience. Solutions proposed 
the big picture of what the institution needs by Thought Leaders participants include the 

TLS to protect on campus. She recommends the following: 

:) following steps: 
= A mapping exercise of the campus M@ Build strategic partnerships with unions, suppli- 

identifies structures and infrastructure and ers, contractors, and trade schools. 


the hazards that might accompany them. 
Maps should show all structures, essential 


M Create training programs to build the workforce 
services, locations of hazardous materi- a 
H 


from within. 

Communicate the need to senior leadership, so 
the institution understands the needs and risks. 
Collaborate with HR to create internships and 
apprenticeships and to update retention and 
benefit plans to attract needed staff. 

M Define the skills needed for the future workforce 


als, critical infrastructure, and important 
off-campus sites including fire stations, 
hospitals and student housing. 


@ An asset inventory prioritizes the 
physical components identified during 
the mapping exercises. The goal is to 


identify assets that will be critical to main- in order to clarify your needs. 

taining the institution in the event of an M Promote facilities as a profession. 

emergency, including which buildings or 

portions of buildings house critical func- Technology failures. Technology is increasingly 

Wels integrated into buildings and infrastructure systems, 
& A business impact analysis identifies to the benefit of colleges of universities. However, 

the likely implications of risks to the in- the more campuses rely on these systems, the 

stitution’s business processes—which, greater the risk if they fail. Institutions need to 


in higher education, include housing and 
feeding students, continuing instruction, 
caring for lab animals, maintaining tele- 
communications, etc. Each unit of the 


integrate fail-safes and redundancies into building 
technologies that will keep the campus operational 
even if new smart systems fail. The technology be- 


institution must identify the maximum hind these systems is still fairly new, so institutions 
allowable downtime, cost associated with need to ask a lot of “what if” questions. What if 
downtime, and objectives for achieving there’s an extended power outage? What if sensors 
EEDA: are flooded? What if WiFi goes out? 

Source: Adapted from Janice M. Abraham, 

“Confronting Catastrophe,” Business Officer, One of the major risks of advanced facilities tech- 

January 2018. nology—and the Internet-of-Things (IoT) in 


particular—is cybersecurity. Many IoT systems 
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have either no security or poor security, and as re- 
cently as 2015, a survey by FacilitiesNet found that 
only 29 percent of facilities professionals surveyed 
were taking or had completed any measures to im- 
prove the cybersecurity of their building systems. 
Awareness of the problem is growing, and vendors 
are responding with more secure systems, but the 
risk of a bad actor either gathering information or 
interfering with your campus remains real. 


Steps to mitigate risks from technology failures in- 
clude the following: 


@ Create continuity operations plans that include 
options for alternate services. 

@ Improve the redundancy and resiliency of systems. 

M@ Pre-establish emergency service contracts so that 
if or when a crisis occurs, you need only to make 
a phone call to get expert help. 

@ Institute alternative communications plans and 
procedures in case primary systems fail. 

M Review the security of Internet-connected build- 
ing technologies and adopt best practices for 
securing systems from cyberattacks. 


Utility infrastructure failures. Utility failures pose 
enormous risks for colleges and universities. As 
well as interfering with normal instruction and op- 
erations, utility failures pose many other problems: 
Student safety becomes an issue when lighting 
failures throw campuses into darkness; research 
programs are threatened when power shuts down to 
critical vent hoods and pumps; the lives of research 
animals are put at risk when climate control sys- 
tems fail; and human lives are on the line when 
water or power shuts off to university medical centers. 


Fortunately, most campuses have experienced utility 
failures before and have invested time in preparing 
mitigation plans. But participants at the Thought 
Leaders symposium urged colleagues not to get 
complacent. Every utility outage plays out in dif- 
ferent ways, and institutions need to keep their 
plans fresh. They also need to regularly conduct 
drills and practice exercises to reinforce procedures 
and determine where changes to the campus— 
new systems, new buildings, or a new stakeholder 
group—need to be accommodated in the plans. 


Specific steps urged by Thought Leaders partici- 
pants include the following: 


M@ Design systems for redundancy and resiliency. 

HM Pre-establish emergency services contracts to en- 
sure the support you need is available as soon as 
you need it. 

M Create and test communications protocols. 

MH Conduct preventive and predictive maintenance 
on campus infrastructure to try to prevent 
failures. 

M Regularly assess the condition of infrastructure, 
including risk to the campus. 


Data Point: 
Facilities risks 
Coordinating contingency plans 


“While many universities have developed 
space contingency plans at the department 
or college level, most universities lack a co- 
ordinating mechanism to identify conflicts 
between such plans. 


“For example, multiple academic or adminis- 
trative units often designate the same building 
as their backup space in case current facilities 
become unusable (e.g., from flood or storm 
damage). However, in the event that multiple 
facilities across campus shut down, backup 
plans conflict, leaving the institution scram- 
bling to improvise a solution (which is often 
quite expensive or disruptive). In addition, as 
the recession has significantly dampened new 
building construction (while enrollment has 
continued to grow), administrators have far 
less flexibility with which to handle a sudden, 
unexpected need for temporary space.” 


Source: University Business Executive Round- 
table, A Practical Approach to Institutional Risk 
Management: Getting Risk Right in an Era of 
Constrained Administrative Resources, The 
Advisory Board Company, 2012. 


Compliance issues. During every election cycle, 
politicians announce they will reduce regulation, 
but the regulatory burden on colleges and uni- 
versities only seems to grow. A survey of higher 
education presidents found that 85 percent believe 
the federal government is likely to significantly 
increase regulations, according to a report by 

the University Business Executive Roundtable. 
Enforcement is also increasing, especially for in- 
ternational activities, notes the same report. The 
number of individuals on campus who fall under 
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regulations has also grown to include faculty and 
staff who have never dealt with compliance issues. 
Colleges and universities need to be deliberate 
about compliance and seek to create a culture in 
which compliance isn’t a burden, but rather part of 
how the campus does business. 


Steps recommended by the Senior Facilities Offi- 
cers at the Thought Leaders symposium included 
the following: 


M@ Identify responsible stakeholders—“owners”— 
for different areas of compliance and give them 
both authority and accountability. 

Regularly review compliance protocols to iden- 
tify gaps and weaknesses. 

Prioritize and coordinate compliance efforts to 
reduce confusion. 

Tie your compliance efforts to your institution’s 
values. 

Create a culture of excellence, not merely 
box-ticking. 


Institutional curb appeal/first impression. Re- 
search by APPA and other organizations has 
confirmed that the condition and appearance of fa- 


cilities plays a significant role in the recruitment and 


retention of students at colleges and universities. 
Prospective students rarely choose an institution 
solely because of the quality or appearance of their 
buildings and grounds, but facilities play a part 

in their decision making, especially facilities that 
will play a significant role in their academic path 
(for example, a nursing student cares a great deal 
about the facilities devoted to practical education.) 
And facilities certainly cause students to reject a 
college or university because important spaces were 
missing, inadequate, or poorly maintained. Poorly 
maintained facilities, therefore, pose a risk to the 
institution. They can drive away students and dis- 
courage faculty and staff. 


Thought Leaders participants urge institutions 
to take the following steps to mitigate the risk of 
making a bad first impression: 


HM Make the case to senior campus leadership of 
the value of the first impression of the campus, 
pointing out both risks and opportunities. 

M Develop a relationship with the admissions de- 
partment to strategize where to focus efforts on 
creating the best impression. 
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Data Point: 
Facilities risks 
Compliance matrix program 


“With ever-increasing compliance require- 
ments, the average university chief business 
officer is often left wondering if local units 
are keeping up with compliance activities, or 
if they are even aware of the requirements at 
all... 


“To keep the campus abreast of ever-ris- 

ing compliance requirements, Washington 
and Lee University developed a full suite of 
compliance initiatives. At the core of the ini- 
tiatives is the compliance matrix. The matrix 
delineates responsibility and oversight for 
key compliance activities. Each of the uni- 
versity’s compliance areas is assigned to a 
cognizant policy officer and compliance part- 
ner. The cognizant policy officer is a member 
from the President's Cabinet and has overall 
responsibility for that compliance area. The 
compliance partner is generally a unit-level 
administrator assigned day-to-day responsibil- 
ity of the compliance area. 


“The compliance matrix is enveloped by a 
suite of services offered by the Office of Gen- 
eral Counsel. Compliance calendars provide 
an overview of federal reporting requirements 
by functional unit. Additionally, push notifica- 
tions from the Office of General Counsel keep 
local units abreast of compliance modifica- 
tions, while optional compliance worksheets 
are available to units to assess potential com- 
pliance gaps.” 

Source: University Business Executive Round- 
table, A Practical Approach to Institutional Risk 
Management: Getting Risk Right in an Era of 


Constrained Administrative Resources, The Advi- 
sory Board Company, 2012. 


Regularly review your wayfinding plan and en- 
sure that the campus is pedestrian-friendly. 
Conduct daily inspections to keep spaces looking 
their best. 

Remember that all aspects of facilities come 
under public scrutiny, including the appearance 
of equipment, vehicles, and people. 

Promote the idea of stewardship of the campus 
both within the facilities organization and to the 
campus community. Encourage everyone to take 
pride in the campus and keep it looking its best. 
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Opportunities for the facilities 
organization 


Energy conservation. Senior Facilities Officers 
can create new opportunities for flexibility and cost 
savings for their institutions by conserving energy. 
Energy costs fluctuate widely over time, making 

it difficult to predict energy expenses for institu- 
tions in the long term. This creates uncertainty 
that poses a risk. By reducing energy demand on 
campus, the facilities organization can reduce risk 
exposure from volatile energy markets. 


Fuel and utility strategies. A related opportunity 
for colleges and universities is the creation of fuel 
and utility strategies. Smart planning can limit the 
impact of sharp spikes in any particular fuel type, so 
if oil prices rise suddenly, the institution isn’t dev- 
astated. Fuel strategies can also increase reliance on 
renewable energy sources and create new opportu- 
nities for the institution to generate its own energy 
and become less dependent on public utilities, re- 
ducing risk if those utility systems fail. 


Green technology. Green technologies create op- 
portunities to improve the lives of students, faculty, 
and staff while using resources efficiently, reducing 
environmental impacts, and improving ecosystems. 
Green buildings are designed to improve indoor 

air quality and increase natural light, both of which 
have been shown to support learning. At the same 
time, green systems reduce water consumption, 
increase the use of recycled and renewable products, 
and limit the emission of greenhouse gases. Out of 
all stakeholders on college and university campuses, 
facilities organizations have the greatest oppor- 
tunity to make a real impact on the institution’s 
environmental footprint. 


Facilities supporting student success. Student 
success is usually framed in terms of instruction, 
academic advising, and academic support services, 
but facilities also play a role. It’s difficult to learn 
well in a classroom that is too hot, too cold, or 
filled with buckets to catch the rain. Well-designed 
and maintained facilities, on the other hand, help 
students navigate the campus, improve student 
security, integrate technology, and promote inclu- 
sivity. The facilities organization has an opportunity 
to improve the campus built environment in ways 
that make the needs of students the number one 


priority. 


Resources to respond to emergencies. As previ- 
ously discussed, facilities organizations have a large 
and well-trained workforce that is able to step in 
when the campus is in crisis. 


Data Point: 


Risks and opportunities for higher 
education facilities organizations 


Identifying emerging risks 


The APPA Thought Leaders Risk Survey asked 
Senior Facilities Officers to identify risks they 
believe could come to threaten the institution 
as a whole and facilities in particular. Their re- 
sponses include the following: 


Cybersecurity 

Mental health challenges 

Aging workforce/loss of institutional 
knowledge 

Managing social media 

Traumatic brain injury 

#MeToo movement 

Title IX issues 

Free speech/demonstration on campus 
Security risks including terrorism and ac- 
tive shooter situations 

Affordability 

Student loan debt 

Changing cultural attitudes about higher 
education 

Changing demographics 

Declining enrollment 

Financial uncertainty 

Regulatory overreach 

Campus growth putting pressure on aging 
infrastructure 

Competition 

Failure to maintain a standard to compete 
for top researchers 

Failure to grow endowment to meet fund- 
ing needs 

Sea-level rise 

Aging buildings and infrastructure 
Declining number of skilled trades 
Attracting and retaining staff 

Lack of succession planning critical 
functions. 


Source: APPA Thought Leaders Risk Survey, 
January 2018. 
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Questions to Promote Discussion 


t has always been a goal of the APPA Thought 

Leaders Series to encourage discussion and debate 

on campuses across the United States and Can- 
ada. Participants at the symposium developed the 
following questions about how facilities can help 
manage risks and opportunities on your college or 
university campus. 


We encourage readers to share these questions 
within your facilities organization and across cam- 
pus departments. Take a hard look at your campus 
and consider what facilities can do to make the in- 
stitution more adaptable to risk and change. 


Managing risk across the campus 


® How much risk is your institution willing to 
tolerate? 


Data Point: 
Promoting campus discussion 
How does your institution view risk? 


In NACUBO’s report “Developing a Strategy 

to Manage Enterprisewide Risk in Higher 
Education,” the authors advise ranking your 
institution’s approach to risk management. Un- 
derstanding how your campus views risk is the 
first step toward reducing threats. 


Level I: Sees little value in proactive risk man- 
agement. Implements risk control mechanisms 
only when an unmanaged risk turns into a 
problem or crisis. 


Level Il: Has some conceptual appreciation 
for the value of risk in ensuring that not all 
uncertainties become problems, but lacks any 
centralized processes or monitoring and has 
no defined accountability for risk. 


How are you building resilience on your campus? 
How do you create a campus culture that deters 
risk? 

How does your campus define risks and 

opportunities? 

Who is responsible for risk? Who isn’t involved 

in the risk conversation but should be involved? 

What are the sacred cows on your campus? 

What challenges do they pose? How can you 

mitigate those challenges? 

HM Does your campus have a defined ERM strat- 
egy? If so, how well is it working? If not, what 
would it take for the campus to commit to 
ERM? 

HB How often do you test and update your 

emergency plan? 


Level Ill: Is aware of risk management and 
sets up some monitoring mechanisms. May 
promote risk self-assessments or the internal 
audit function may audit for risk. 


Level IV: Has a broader understanding of risk 
and considers both qualitative and quantitative 
risk factors. Regularly reviews hot topics, as- 
sesses risks within business units, and assigns 
risk to a senior institution officer. 


Level V: Risk is a CEO-level concern. The in- 
stitution believes that risk management should 
be embedded in every part of the organization. 
Each business unit designs its own risk miti- 
gation plans. Training is in place, and internal 
audit monitors the risk management program 
to ensure it is working effectively. 


Source: Adapted from Dale Cassidy et. a/, “Developing a Strategy to Manage Enterprisewide Risk in Higher 


Education,” NACUBO, 2003. 


2018 APPA THOUGHT LEADERS SERIES 


Strengthening the facilities 
organization to better manage risk 


What risks threaten your facilities organization? 
What is the role of facilities leadership in man- 
aging risk for the entire institution? For campus 
facilities? 

Does your facilities organization have adequate 
funding to harden facilities and infrastructure 
against failure? If not, how can you make the 
case that this is critical? 

What is the role of facilities in the case of a 
natural disaster on campus? What opportunities 
exist for facilities to better support the institu- 
tion? 

Is your campus facilities organization threatened 
by workforce shortages and skill-set deficiencies? 
How can you communicate this risk to senior 
campus leadership? What steps can you take to 
recruit and retain qualified staff? 

What strategies are in place to mitigate the risks 
posed by advanced building technology and the 
IoT? Where are those strategies falling short? 
How does your facilities organization keep track 
of regulatory requirements? What processes 
could improve regulatory compliance? 

How can facilities improve the appearance of the 
campus to attract and retain students and 
faculty? 


Seizing opportunities for the entire 
institution 


M How can your campus better assess opportunities 
alongside risks? 

M Does your institution have a mechanism to iden- 
tify opportunities and bring them to decision 
makers? 

MH Does your campus have the flexibility and adapt- 
ability to seize opportunities as they present 
themselves? What would improve the institu- 
tion’s nimbleness? 


Taking advantage of opportunities 
within the facilities organization 


Mm What steps can you take to prepare your staff to 
be ready to respond to a campus crisis? 

@ How important is energy conservation on your 
campus? Within the facilities organization? How 
can you make the case that reducing energy use 
lowers risk for the institution and creates finan- 
cial opportunities? 

MH Does your campus have a fuel and utility strategy 
that reduces risk? How can you implement such 
a strategy? 

MH What is your campus’s commitment to green 
technology? Would increased investment in 
green materials and systems improve quality of 
life on campus? What would it take to create a 
greener campus? 

MH How can you make the case to campus lead- 
ers that facilities investment supports student 
success? How are you seeking to improve the 
student experience now? What gaps do you need 
to fill? 
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Section /: 
Conclusion 


the more overwhelming the task of managing 

risk can feel. It’s easy to get discouraged when 
looking at the long list of threats to colleges and 
universities and the monumental efforts required 
to mitigate those threats. It’s easy for a sense of fa- 
talism to creep in—what can any one individual do 
against fires, floods, scandals, economic downturns, 
political movements, cultural shifts, technological 
transformations, and negative social media cam- 
paigns? 


| here’s a truth about risk: The more you know, 


The answer, surprisingly, is a lot. 
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One of the underlying themes of this report is 
leadership. It takes leadership to recognize the risks 
to higher education and to have the courage to 
confront them. It takes leadership to own risk and 
to be accountable for change. It takes leadership to 
see an opportunity when it arises and to seize that 


opportunity. 


We at APPA encourage campus leaders in gen- 
eral and Senior Facilities Officers in particular to 
step up and become the leaders their colleges and 
universities need in this time when risks seem so 
daunting. Because even if one individual cannot 
prepare an institution for all of the risks it faces 
today, one leader can give that institution the confi- 
dence it needs to face the future. 
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